From 92af9a97926b186375529b79369d316494f01dce Mon Sep 17 00:00:00 2001
From: jiblime <47689567+jiblime@users.noreply.github.com>
Date: Wed, 18 Dec 2019 21:40:01 -0800
Subject: [PATCH 1/6] Fixes definition error when the deprecated
MBEDTLS_ZLIB_SUPPORT and ENABLE_ZLIB_SUPPORT macro are defined/enabled for
zlib support in mbedtls
100% tests passed, 0 tests failed out of 85
https://github.com/ARMmbed/mbedtls/blob/mbedtls-2.19.1/library/ssl_tls.c#L1842
https://github.com/ARMmbed/mbedtls/blob/mbedtls-2.19.1/library/ssl_tls.c#L1862
Signed-off-by: Simon Butcher <simon.butcher@arm.com>
---
library/ssl_tls.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 1d5503b9b..a773c9d92 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -1960,7 +1960,7 @@ int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl )
/* Allocate compression buffer */
#if defined(MBEDTLS_ZLIB_SUPPORT)
- if( session->compression == MBEDTLS_SSL_COMPRESS_DEFLATE &&
+ if( ssl->session_negotiate->compression == MBEDTLS_SSL_COMPRESS_DEFLATE &&
ssl->compress_buf == NULL )
{
MBEDTLS_SSL_DEBUG_MSG( 3, ( "Allocating compression buffer" ) );
From e4d4b1f3d3bb7c09330eef0a51139fa6ebb7bde8 Mon Sep 17 00:00:00 2001
From: Gilles Peskine <Gilles.Peskine@arm.com>
Date: Wed, 22 Jan 2020 19:18:35 +0100
Subject: [PATCH 2/6] Add changelog entry for the zlib support fix
Signed-off-by: Simon Butcher <simon.butcher@arm.com>
---
ChangeLog | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/ChangeLog b/ChangeLog
index 82483e869..6ba9a5a3a 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -2,6 +2,10 @@ mbed TLS ChangeLog (Sorted per branch, date)
= mbed TLS "baremetal" branch
+Bugfix
+ * Fix build failure with MBEDTLS_ZLIB_SUPPORT enabled. Reported by
+ Jack Lloyd in #2859. Fix submitted by jiblime in #2963.
+
Features
* Add new configuration option MBEDTLS_SSL_NO_SESSION_CACHE that enables
code size savings in configurations where cache-based session resumption is
From df59bfc9d667b7615661cd8a09436696651042a2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?=
<manuel.pegourie-gonnard@arm.com>
Date: Thu, 2 Jan 2020 11:45:12 +0100
Subject: [PATCH 3/6] Add all.sh components with ZLIB enabled
ZLIB support is deprecated, but until it's removed it should still be tested.
Signed-off-by: Simon Butcher <simon.butcher@arm.com>
---
tests/scripts/all.sh | 25 +++++++++++++++++++++++++
1 file changed, 25 insertions(+)
diff --git a/tests/scripts/all.sh b/tests/scripts/all.sh
index 0ea4ae818..6a5b849fb 100755
--- a/tests/scripts/all.sh
+++ b/tests/scripts/all.sh
@@ -651,6 +651,31 @@ component_test_full_cmake_gcc_asan () {
if_build_succeeded tests/compat.sh
}
+component_test_zlib_make() {
+ msg "build: zlib enabled, make"
+ scripts/config.pl set MBEDTLS_ZLIB_SUPPORT
+ make ZLIB=1 CFLAGS='-Werror -O1'
+
+ msg "test: main suites (zlib, make)"
+ make test
+
+ msg "test: ssl-opt.sh (zlib, make)"
+ if_build_succeeded tests/ssl-opt.sh
+}
+
+component_test_zlib_cmake() {
+ msg "build: zlib enabled, cmake"
+ scripts/config.pl set MBEDTLS_ZLIB_SUPPORT
+ cmake -D ENABLE_ZLIB_SUPPORT=On -D CMAKE_BUILD_TYPE:String=Check .
+ make
+
+ msg "test: main suites (zlib, cmake)"
+ make test
+
+ msg "test: ssl-opt.sh (zlib, cmake)"
+ if_build_succeeded tests/ssl-opt.sh
+}
+
component_test_ref_configs () {
msg "test/build: ref-configs (ASan build)" # ~ 6 min 20s
CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
From 079864ef542bdb5688a29b3ac5e3071fd5d942ae Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?=
<manuel.pegourie-gonnard@arm.com>
Date: Thu, 2 Jan 2020 11:58:00 +0100
Subject: [PATCH 4/6] Add test for record compression in ssl-opt.sh
Deprecated but still needs to be tested.
Signed-off-by: Simon Butcher <simon.butcher@arm.com>
---
tests/ssl-opt.sh | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh
index cd0b03119..00ed39150 100755
--- a/tests/ssl-opt.sh
+++ b/tests/ssl-opt.sh
@@ -1150,6 +1150,18 @@ run_test "Default, choose highest security suite and hash, DTLS" \
-s "client hello v3, signature_algorithm ext: 6" \
-s "ECDHE curve: secp521r1"
+requires_config_enabled MBEDTLS_ZLIB_SUPPORT
+run_test "Default (compression enabled)" \
+ "$P_SRV debug_level=3" \
+ "$P_CLI debug_level=3" \
+ 0 \
+ -s "Allocating compression buffer" \
+ -c "Allocating compression buffer" \
+ -s "Record expansion is unknown (compression)" \
+ -c "Record expansion is unknown (compression)" \
+ -S "error" \
+ -C "error"
+
# Test current time in ServerHello
requires_config_enabled MBEDTLS_HAVE_TIME
run_test "ServerHello contains gmt_unix_time" \
From ae48d86cb166e42986d52b7a8aabf158f69c5f16 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?=
<manuel.pegourie-gonnard@arm.com>
Date: Fri, 3 Jan 2020 12:18:49 +0100
Subject: [PATCH 5/6] Fix bug in record decompression
ssl_decompress_buf() was operating on data from the ssl context, but called at
a point where this data is actually in the rec structure. Call it later so
that the data is back to the ssl structure.
Signed-off-by: Simon Butcher <simon.butcher@arm.com>
---
library/ssl_tls.c | 34 +++++++++++++++++++++-------------
1 file changed, 21 insertions(+), 13 deletions(-)
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index a773c9d92..146a8f1e9 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -5587,7 +5587,7 @@ static int ssl_check_client_reconnect( mbedtls_ssl_context *ssl )
#endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */
/*
- * If applicable, decrypt (and decompress) record content
+ * If applicable, decrypt record content
*/
static int ssl_prepare_record_content( mbedtls_ssl_context *ssl,
mbedtls_record *rec )
@@ -5710,18 +5710,6 @@ static int ssl_prepare_record_content( mbedtls_ssl_context *ssl,
}
-#if defined(MBEDTLS_ZLIB_SUPPORT)
- if( ssl->transform_in != NULL &&
- ssl->session_in->compression == MBEDTLS_SSL_COMPRESS_DEFLATE )
- {
- if( ( ret = ssl_decompress_buf( ssl ) ) != 0 )
- {
- MBEDTLS_SSL_DEBUG_RET( 1, "ssl_decompress_buf", ret );
- return( ret );
- }
- }
-#endif /* MBEDTLS_ZLIB_SUPPORT */
-
#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
{
@@ -6609,6 +6597,26 @@ static int ssl_get_next_record( mbedtls_ssl_context *ssl )
ssl->in_msglen = rec.data_len;
(void)mbedtls_platform_put_uint16_be( ssl->in_len, rec.data_len );
+#if defined(MBEDTLS_ZLIB_SUPPORT)
+ if( ssl->transform_in != NULL &&
+ ssl->session_in->compression == MBEDTLS_SSL_COMPRESS_DEFLATE )
+ {
+ if( ( ret = ssl_decompress_buf( ssl ) ) != 0 )
+ {
+ MBEDTLS_SSL_DEBUG_RET( 1, "ssl_decompress_buf", ret );
+ return( ret );
+ }
+
+ /* Check actual (decompress) record content length against
+ * configured maximum. */
+ if( ssl->in_msglen > MBEDTLS_SSL_IN_CONTENT_LEN )
+ {
+ MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
+ return( MBEDTLS_ERR_SSL_INVALID_RECORD );
+ }
+ }
+#endif /* MBEDTLS_ZLIB_SUPPORT */
+
return( 0 );
}
From f0658b18dcb05bb41f06e285734370301ab352f9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?=
<manuel.pegourie-gonnard@arm.com>
Date: Fri, 24 Jan 2020 10:17:20 +0100
Subject: [PATCH 6/6] Add detection for zlib headers to all.sh
Signed-off-by: Simon Butcher <simon.butcher@arm.com>
---
tests/scripts/all.sh | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/tests/scripts/all.sh b/tests/scripts/all.sh
index 6a5b849fb..bd7e98f6c 100755
--- a/tests/scripts/all.sh
+++ b/tests/scripts/all.sh
@@ -662,6 +662,17 @@ component_test_zlib_make() {
msg "test: ssl-opt.sh (zlib, make)"
if_build_succeeded tests/ssl-opt.sh
}
+support_test_zlib_make () {
+ base=support_test_zlib_$$
+ cat <<'EOF' > ${base}.c
+#include "zlib.h"
+int main(void) { return 0; }
+EOF
+ gcc -o ${base}.exe ${base}.c -lz 2>/dev/null
+ ret=$?
+ rm -f ${base}.*
+ return $ret
+}
component_test_zlib_cmake() {
msg "build: zlib enabled, cmake"
@@ -675,6 +686,9 @@ component_test_zlib_cmake() {
msg "test: ssl-opt.sh (zlib, cmake)"
if_build_succeeded tests/ssl-opt.sh
}
+support_test_zlib_cmake () {
+ support_test_zlib_make "$@"
+}
component_test_ref_configs () {
msg "test/build: ref-configs (ASan build)" # ~ 6 min 20s